* FITS demuxer.
*/
+#include "libavutil/avassert.h"
#include "libavutil/intreadwrite.h"
#include "internal.h"
#include "libavutil/opt.h"
int64_t pts;
} FITSContext;
-static int fits_probe(AVProbeData *p)
+static int fits_probe(const AVProbeData *p)
{
const uint8_t *b = p->buf;
if (!memcmp(b, "SIMPLE = T", 30))
size += header->pcount;
t = (abs(header->bitpix) >> 3) * ((int64_t) header->gcount);
- if(size && t > UINT64_MAX / size)
+ if(size && t > INT64_MAX / size)
return AVERROR_INVALIDDATA;
size *= t;
if (!size) {
image = 0;
} else {
- if(FITS_BLOCK_SIZE - 1 > UINT64_MAX - size)
+ if(FITS_BLOCK_SIZE - 1 > INT64_MAX - size)
return AVERROR_INVALIDDATA;
size = ((size + FITS_BLOCK_SIZE - 1) / FITS_BLOCK_SIZE) * FITS_BLOCK_SIZE;
}
av_bprint_init(&avbuf, FITS_BLOCK_SIZE, AV_BPRINT_SIZE_UNLIMITED);
while ((ret = is_image(s, fits, &header, &avbuf, &size)) == 0) {
+ av_bprint_finalize(&avbuf, NULL);
pos = avio_skip(s->pb, size);
if (pos < 0)
return pos;
- av_bprint_finalize(&avbuf, NULL);
av_bprint_init(&avbuf, FITS_BLOCK_SIZE, AV_BPRINT_SIZE_UNLIMITED);
avpriv_fits_header_init(&header, STATE_XTENSION);
}
goto fail;
}
+ av_assert0(avbuf.len <= INT64_MAX && size <= INT64_MAX);
+ if (avbuf.len + size > INT_MAX - 80) {
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
+ }
// Header is sent with the first line removed...
ret = av_new_packet(pkt, avbuf.len - 80 + size);
if (ret < 0)
ret = av_bprint_finalize(&avbuf, &buf);
if (ret < 0) {
- av_packet_unref(pkt);
return ret;
}
av_freep(&buf);
ret = avio_read(s->pb, pkt->data + pkt->size, size);
if (ret < 0) {
- av_packet_unref(pkt);
return ret;
}
.version = LIBAVUTIL_VERSION_INT,
};
-AVInputFormat ff_fits_demuxer = {
+const AVInputFormat ff_fits_demuxer = {
.name = "fits",
.long_name = NULL_IF_CONFIG_SMALL("Flexible Image Transport System"),
.priv_data_size = sizeof(FITSContext),